Cisco ASA: All-in-One Firewall, IPS, Anti-X, and VPN Adaptive Security Appliance

1151 Pages·2009·28.05 MB·English

by  Jazib Frahim

Cisco ASA
All-in-One Firewall, IPS, Anti-X, and
VPN Adaptive Security Appliance,
Second Edition
Jazib Frahim, CCIE No. 5459
Omar Santos
Cisco Press
800 East 96th Street
Indianapolis, IN 46240
ii Cisco ASA: All-in-One Firewall, IPS, Anti-X, and VPN Adaptive Security Appliance
Cisco ASA: All-in-One Firewall, IPS, Anti-X, and VPN
Adaptive Security Appliance, Second Edition
Jazib Frahim, Omar Santos
Copyright © 2010 Cisco Systems, Inc.
Published by:
Cisco Press
800 East 96th Street
Indianapolis, IN 46240 USA
All rights reserved. No part of this book may be reproduced or transmitted in any form or by any means,
electronic or mechanical, including photocopying, recording, or by any information storage and retrieval
system, without written permission from the publisher, except for the inclusion of brief quotations in a
review.
Printed in the United States of America
First Printing December 2009
Library of Congress Cataloging-in-Publication data is on file.
ISBN-13: 978-1-58705-819-6
ISBN-10: 1-58705-819-7
Warning and Disclaimer
This book is designed to provide information about Cisco ASA. Every effort has been made to make this
book as complete and as accurate as possible, but no warranty or fitness is implied.
The information is provided on an “as is” basis. The authors, Cisco Press, and Cisco Systems, Inc., shall have
neither liability nor responsibility to any person or entity with respect to any loss or damages arising from
the information contained in this book or from the use of the discs or programs that may accompany it.
The opinions expressed in this book belong to the author and are not necessarily those of Cisco Systems, Inc.
Trademark Acknowledgments
All terms mentioned in this book that are known to be trademarks or service marks have been appropriate-
ly capitalized. Cisco Press or Cisco Systems, Inc., cannot attest to the accuracy of this information. Use of
a term in this book should not be regarded as affecting the validity of any trademark or service mark.
iii
Corporate and Government Sales
The publisher offers excellent discounts on this book when ordered in quantity for bulk purchases or spe-
cial sales, which may include electronic versions and/or custom covers and content particular to your busi-
ness, training goals, marketing focus, and branding interests. For more information, please contact: U.S.
Corporate and Government Sales
1-800-382-3419
[email protected]
For sales outside the United States please contact:
International Sales
[email protected]
Feedback Information
At Cisco Press, our goal is to create in-depth technical books of the highest quality and value. Each book
is crafted with care and precision, undergoing rigorous development that involves the unique expertise of
members from the professional technical community.
Readers’ feedback is a natural continuation of this process. If you have any comments regarding how we
could improve the quality of this book, or otherwise alter it to better suit your needs, you can contact us
through email at [email protected]. Please make sure to include the book title and ISBN in your
message.
We greatly appreciate your assistance.
Publisher:Paul Boger Business Operation Manager, Cisco Press:Anand Sundaram
Associate Publisher:Dave Dusthimer Manager Global Certification:Erik Ullanderson
Executive Editor:Brett Bartow Technical Editors:Randy Ivener, Jay Johnston
Managing Editor:Patrick Kanouse Development Editors:Kimberley Debus, Dayna Isley
Project Editor:Seth Kerney Copy Editor:Margo Catts
Book and Cover Designer:Louisa Adair Editorial Assistant:Vanessa Evans
Composition:Mark Shirar Indexer:Ken Johnson
Proofreaders:Water Crest Publishing, Inc., Apostrophe Editing Services
iv Cisco ASA: All-in-One Firewall, IPS, Anti-X, and VPN Adaptive Security Appliance
About the Authors
Jazib Frahim, CCIE No. 5459, has been with Cisco Systems for more than ten years.
With a bachelor’s degree in computer engineering from Illinois Institute of Technology,
he started out as a TAC engineer in the LAN Switching team. He then moved to the TAC
Security team, where he acted as a technical leader for the security products. He led a
team of 20 engineers in resolving complicated security and VPN technologies. He is cur-
rently working as a technical leader in the Worldwide Security Services Practice of
Advanced Services for Network Security. He is responsible for guiding customers in the
design and implementation of their networks with a focus on network security. He holds
two CCIEs, one in routing and switching and the other in security. He has written numer-
ous Cisco online technical documents and has been an active member on the Cisco online
forum NetPro. He has presented at Networkers on multiple occasions and has taught
many on-site and online courses to Cisco customers, partners, and employees.
While working for Cisco, he pursued his master of business administration (MBA) degree
from North Carolina State University.
He is also an author of the following Cisco Press books:
■ Cisco ASA: All-in-One Firewall, IPS, and VPN Adaptive Security Appliance
■ Cisco Network Admission Control, Volume II: NAC Deployment and
Troubleshooting
■ SSL Remote Access VPNs
Omar Santosis an incident manager at Cisco’s Product Security Incident Response Team
(PSIRT). Omar has designed, implemented, and supported numerous secure networks for
Fortune 500 companies and the U.S. government, including the United States Marine
Corps (USMC) and the U.S. Department of Defense (DoD). He is also the author of many
Cisco online technical documents and configuration guidelines. Prior to his current role,
he was a technical leader within the World Wide Security Practice and Cisco’s Technical
Assistance Center (TAC), where he taught, led, and mentored many engineers within both
organizations.
Omar has also delivered numerous technical presentations to Cisco customers and part-
ners; as well as executive presentations to CEOs, CIOs, and CSOs of many organizations.
He is also the author of the following Cisco Press books:
■ Cisco ASA: All-in-One Firewall, IPS, and VPN Adaptive Security Appliance
■ Cisco Network Admission Control, Volume II: NAC Deployment and
Troubleshooting
■ End-to-End Network Security: Defense-in-Depth
v
About the Technical Reviewers
Randy Ivener, CCIE No. 10722, is a security engineer in the Cisco Security Research
and Operations team. He is a CISSP and PMI PMP. He has spent many years as a network
security consultant helping companies understand and secure their networks. Randy has
presented security topics at industry events including Blackhat and Cisco Networkers.
Before becoming immersed in information security, he spent time in software develop-
ment and as a training instructor. Randy graduated from the U.S. Naval Academy and
holds an MBA.
Jay Johnston, CCIE No. 17663, is a security specialist in the Cisco TAC center located in
Research Triangle Park, North Carolina. His networking career began in 2002 when he
joined Cisco as a co-op while attending North Carolina State University. After graduating
with a bachelors of computer science in 2004, he joined Cisco full time as a TAC
Engineer. He obtained his Security CCIE in 2007. He enjoys working for Cisco, especial-
ly the constant technical challenges that working with customers in the TAC provides.
vi Cisco ASA: All-in-One Firewall, IPS, Anti-X, and VPN Adaptive Security Appliance
Dedications
Jazib Frahim:I would like to dedicate this book to my lovely wife, Sadaf, who has
patiently put up with me during the writing process.
I would also like to dedicate this book to my parents, Frahim and Perveen, who support
and encourage me in all my endeavors.
Finally, I would like to thank my siblings, including my brother Shazib and sisters Erum and
Sana, sister-in-law Asiya, my cute nephew Shayan, and my adorable nieces Shiza and Alisha.
Thank you for your patience and understanding during the development of this book.
Omar Santos:I would like to dedicate this book to my lovely wife, Jeannette, and my
two beautiful children, Hannah and Derek, who have inspired and supported me through-
out the development of this book.
I also dedicate this book to my parents, Jose and Generosa. Without their knowledge,
wisdom, and guidance, I would not have the goals that I strive to achieve today.
Acknowledgments
We would like to thank the technical editors, Randy Ivener and Jay Johnston, for their
time and technical expertise. They verified our work and corrected us in all the major and
minor mistakes that were hard to find. Special thanks go to Aun Raza for reviewing many
chapters prior to final editing.
We would like to thank the Cisco Press team, especially Brett Bartow, Dayna Isley,
Kimberley Debus, and Andrew Cupp for their patience, guidance, and consideration.
Their efforts are greatly appreciated.
Many thanks to our Cisco management team, including David Philips, Ken Cavanagh, and
Jean Reese for their continuous support. They highly encouraged us throughout this project.
Kudos to the Cisco ASA product development team for delivering such a great product.
Their support is also greatly appreciated during the development of this book.
Finally, we would like to acknowledge the Cisco TAC. Some of the best and brightest
minds in the networking industry work there, supporting our Cisco customers often
under very stressful conditions and working miracles daily. They are truly unsung heroes,
and we are all honored to have had the privilege of working side by side with them in the
trenches of the TAC.
vii
Contents at a Glance
Introduction xxiii
Part I: Product Overview
Chapter 1 Introduction to Security Technologies 1
Chapter 2 Cisco ASA Product and Solution Overview 25
Chapter 3 Initial Setup and System Maintenance 49
Part II: Firewall Technology
Chapter 4 Controlling Network Access 141
Chapter 5 IP Routing 231
Chapter 6 Authentication, Authorization, and Accounting (AAA) 311
Chapter 7 Application Inspection 349
Chapter 8 Virtualization 415
Chapter 9 Transparent Firewalls 474
Chapter 10 Failover and Redundancy 521
Chapter 11 Quality of Service 577
Part III: Intrusion Prevention System (IPS) Solutions
Chapter 12 Configuring and Troubleshooting Intrusion Prevention System (IPS) 615
Chapter 13 Tuning and Monitoring IPS 677
Part IV: Content Security
Chapter 14 Configuring Cisco Content Security and Control Security Services
Module 689
Chapter 15 Monitoring and Troubleshooting the Cisco Content Security and
Control Security Services Module 715
Part V: Virtual Private Network (VPN) Solutions
Chapter 16 Site-to-Site IPSec VPNs 735
Chapter 17 IPSec Remote-Access VPNs 799
Chapter 18 Public Key Infrastructure (PKI) 869
Chapter 19 Clientless Remote-Access SSL VPNs 923
Chapter 20 Client-Based Remote-Access SSL VPNs 1027
Index 1067
viii Cisco ASA: All-in-One Firewall, IPS, Anti-X, and VPN Adaptive Security Appliance
Contents
Introduction xxiii
Part I: Product Overview
Chapter 1 Introduction to Security Technologies 1
Firewalls 1
Network Firewalls 2
Stateful Inspection Firewalls 6
Deep Packet Inspection 7
Personal Firewalls 7
Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) 8
Pattern Matching and Stateful Pattern-Matching Recognition 9
Protocol Analysis 10
Heuristic-Based Analysis 11
Anomaly-Based Analysis 11
Virtual Private Networks 12
Technical Overview of IPSec 14
SSL VPNs 21
Summary 23
Chapter 2 Cisco ASA Product and Solution Overview 25
Cisco ASA 5505 Model 26
Cisco ASA 5510 Model 29
Cisco ASA 5520 Model 34
Cisco ASA 5540 Model 36
Cisco ASA 5550 Model 36
Cisco ASA 5580-20 and 5580-40 Models 38
Cisco ASA 5580-20 39
Cisco ASA 5580-40 40
Cisco ASA AIP-SSM Module 41
Cisco ASA AIP-SSM-10 43
Cisco ASA AIP-SSM-20 43
Cisco ASA AIP-SSM-40 43
Cisco ASA Gigabit Ethernet Modules 44
Cisco ASA 4GE-SSM 44
Cisco ASA 5580 Expansion Cards 45
Cisco ASA CSC-SSM Module 46
Summary 47
ix
Chapter 3 Initial Setup and System Maintenance 49
Accessing the Cisco ASA Appliances 49
Establishing a Console Connection 50
Command-Line Interface 52
Managing Licenses 54
Initial Setup 57
Initial Setup via CLI 57
Initial Setup of ASDM 58
Device Setup 67
Setting Up Device Name and Passwords 67
Configuring an Interface 69
DHCP Services 76
IP Version 6 78
IPv6 Header 78
Configuring IPv6 80
Setting Up the System Clock 84
Manual Clock Adjustment 84
Automatic Clock Adjustment Using the Network Time Protocol 86
Configuration Management 88
Running Configuration 88
Startup Configuration 92
Removing the Device Configuration 93
Remote System Management 94
Telnet 95
Secure Shell (SSH) 98
System Maintenance 101
Software Installation 101
Password Recovery Process 106
Disabling the Password Recovery Process 109
System Monitoring 113
System Logging 113
NetFlow Secure Event Logging (NSEL) 125
Simple Network Management Protocol (SNMP) 128
Device Monitoring and Troubleshooting 133
CPU and Memory Monitoring 133
Troubleshooting Device Issues 136
Summary 139